Enterprise cyber incident response plan development and forensic services – 12-Month contract

[Insert Precise Project Description]

{"closingDate":"20 July 2026","briefingSession":"{"date":null,"time":null,"venue":"ion under","is_compulsory":false}"}

{"name":null,"email":null,"phone":null,"department":null,"address":"(s) _________________________________"}

Applicant must be a South African‑registered company, close corporation or partnership; be tax compliant (Income Tax Act and VAT Act); not be listed on the National Treasury Restricted Suppliers database or the Register of Tender Defaulters; comply with PFMA, PPPFA (2022) and Treasury Regulations; meet any applicable CIDB requirements; hold a valid BBBEE status (misrepresentation is a material breach); possess the technical capability and experience to develop IRPs, deliver training and forensic services; have public liability and professional indemnity insurance in place before start‑up; and obtain prior written approval for any subcontracting, remaining fully liable for subcontractor performance.

Sentech SOE have legal and regulatory requirements for information security incident response e.g.

POPIA security compromise and the Cybercrimes Act reporting obligations where applicable, An

enterprise-wide IRP and will define clear decision-making, escalation, and stakeholder

communications to reduce impact, support compliance, and improve organisational resilience.

The scope and objectives of the IR plan identify critical assets, potential threats, and the stakeholders

involved:

• Develop a cyber security incident response plan outlining the steps taken during and after an

attack, helping minimize damage, restore operations swiftly, and ensure compliance with

legal and regulatory requirements.

• Define overlap between IT incident ITIL and cyber incident process.
• Establish an incident response team with clearly assigned roles and responsibilities, ensuring

all members are trained and equipped to act swiftly during an incident.

• Detailed procedures for incident detection, analysis, containment, eradication, and recovery.
• Set up communication protocols, escalation paths, and documentation requirements for

every phase of the response process.

• Ensure compliance with relevant legal and regulatory obligations, such as data breach

notification requirements and evidence preservation for potential investigations.

• Conduct tabletop exercises and simulated attacks, to validate and refine the IR plan.
• Communication plan, notification templates, stakeholder contact list, regulatory reporting

templates, and communication logs.

Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

2.1. Deliverables

No. Functional Description Deliverables

Unit

Description Rate Total

• IR Plan development and 1

project management

• Training IR team 40
• Approximately 40 people

20 July 2026

• IR Forensic support 12
• Hourly rate per incident Hourly

Fixed / variable per node e.g. laptop

or server

• Tabletop exercises x three, 3

one per quarter, final to

include directors

Vat

Total (Including vat)

20 July 2026

Part c3: scope of work

Sentech’s goods information

Xxxxx

Part C2: Pricing Data

Part C3: Scope of Work

Conditions of Contract (available separately)

20 July 2026

Part c1: agreements and contract data –

o Tender Data

o Scope of Work

o Pricing Data

o General Conditions of Contract (GCC)

o Special Conditions of Contract (SCC)

o All Addenda

total Bid offer inclusive of all applicable costs, escalation and taxes for the Contract duration. The price

must be carried over from the price breakdown / schedule of rates provided in the Bid document.

• Part C1 Agreements and contract data, (which includes this agreement)

• Part C2 Pricing data

• Part C3 Scope of work,

and drawings and documents or parts thereof, which may be incorporated by reference into Parts

C1 to C3 above.

20 July 2026

Part 2: pricing data

1.1. Glossary of Terms Abbreviations Descriptions IRP Incident response plan 20 July 2026

Incident Detection Process to detect, Incident reporting process and and Reporting log, and report procedure, incident register, security incidents escalation matrix, alerting use promptly. Clearly cases, and sample incident define criteria for tickets. incidents and set escalation procedures for staff.

Incident Assessment Implement Incident classification and Classification structured standard, severity matrix, procedures for triage checklist, and evaluating and completed classification classifying incidents records. according to their severity, impact, and regulatory significance.

Incident Response Formalize the Incident response team Team and Roles assignment, charter, RACI matrix, role documentation, and descriptions, contact list. training of incident response roles and responsibilities, ensuring comprehensive stakeholder inclusion.

Response Develop detailed, Scenario-based playbooks, Procedures stepwise containment procedures, procedures for recovery procedures, and addressing decision logs. common incident types, including containment, eradication, recovery, and communication protocols.

Notification and Establish a formal Communication plan, Communication plan communication notification templates, framework for regulatory reporting templates, internal and and communication logs. external stakeholders, including regulatory notification requirements to authorities and affected individuals. 20 July 2026

Evidence Define procedures Forensic procedure, evidence Preservation and for the collection, register, chain-of-custody Forensics preservation, and forms, evidence inventory, and forensic analysis of forensic analysis reports. digital evidence to support investigations and legal compliance.

Integrate with Legal Ensure all incident Legal and regulatory and Regulatory response activities obligations register, breach Requirements are aligned with assessment template, applicable notification decision log, legal legislation and review records, and retained contractual compliance evidence. obligations, with legal counsel engagement as appropriate.

Post-Incident Review Conduct structured Post-incident review template, and Improvement reviews following lessons learned report, root incidents to identify cause analysis, corrective lessons learned and action register, and updated update response procedures. strategies, controls, and training program accordingly. 20 July 2026

Awareness and Personnel Training plan, IR, awareness Training understand their materials, competency responsibilities in assessments, and role-based incident response training records. processes.

Continuous Schedule regular, Three scheduled, tabletop Improvement simulated attacks— exercise packs, simulation and ensure reports, issue log, remediation continuous updates tracker, and updated IR plan. to maintain regulatory compliance and operational readiness. 2.2. Acceptance criteria All documents, models, processes, templates, and related deliverables must be provided in editable, reusable, and, where applicable, both Microsoft and open formats. Acceptable formats include DOCX or ODT for text documents, XLSX, XLSM, or ODS for spreadsheets and working models, PPTX or ODP for presentations, VSDX or SVG for diagrams and vector graphics, CSV for tabular data, XML and JSON for structured data exchange, and PDF only as a reference copy and not as the sole deliverable format. The Supplier grants Sentech a perpetual, irrevocable, non-exclusive, royalty-free right to use, reproduce, adapt, modify, maintain, and internally distribute all deliverables for its own business, operational, governance, audit, compliance, and continuity purposes. 20 July 2026

B-BBEE Details: ontract, without prior written approval of Sentech, which consent may be withheld on

reasonable grounds.

20 July 2026

• Where subcontracting is permitted, the Bidder shall comply with the subcontracting requirements

prescribed under Regulation 9 of the Preferential Procurement Regulations, 2022.

• It may not subcontract more than the prescribed threshold, unless permitted by law
• It shall remain fully liable to Sentech for subcontractor performance and will indemnify Sentech for

any loss or damage caused as a result of subcontractor non-performance, theft or misappropriation.

8 BBBEE & Transformation

Where applicable:

• The Contractor shall maintain its declared BBBEE status.
• Misrepresentation constitutes material breach.
• Sentech may request a lawful transformation implementation plan aligned with BBBEE Codes.
• Failure to implement agreed milestones constitutes breach.

9 Pricing and Negotiations

• Prices are fixed in ZAR unless otherwise stated. Any foreign currency quotations shall be and remain

fixed for the full duration of the contract. Sentech is indemnified against any risk of price and/or

currency fluctuations, and such risks shall be solely borne by the Bidder.

• No escalation unless provided for in SCC. Applications for price adjustment must be accompanied by

documentary evidence in support of any adjustment and may be rejected on reasonable grounds.

• All prices inclusive of VAT.
• Documentary proof required for approved adjustments.
• Sentech reserves the right to negotiate market related prices and discounts. If market-related prices

are not agreed upon, Sentech reserves the right to terminate negotiations and invite the subsequent

ranked Bidder for negotiations or alternatively cancel the Bid.

10 Payment

10.1 All

A contract between

SENTECH, Sender Technology Park, Radiokop, Octave Road, Honeydew

and

Appointment of a service provider for enterprise cyber incident

Response plan (irp) development and forensic services for a period of 12

Months

Bid Number: RFX 6000003513

Contents

Part C1: Agreements and contract data

Form of Offer and Acceptance

Contract Data provided by the Sentech

Contract Data provided by the Supplier

Part C2: Pricing Data

Part C3: Scope of Work

Conditions of Contract (available separately)

20 July 2026

Part c1: agreements and contract data –

Form of Offer and Acceptance Offer

Offer

Sentech SOC Limited (“Sentech”), a state-owned company duly incorporated in accordance with the laws of

the Republic of South Africa and listed as a Schedule 2 public entity under the Public Finance Management

Act, has solicited bids to enter into a contract for:

[Insert Precise Project Description]

The Bidder irrevocably warrants that:

1. It has examined all Bid documents, including:

o Tender Data

o Scope of Work

o Pricing Data

o General Conditions of Contract (GCC)

o Special Conditions of Contract (SCC)

o All Addenda

2. It complies with:

o PFMA

o PPPFA and Regulations (2022)

o Treasury Regulations

o Applicable CIDB requirements (where works apply)

o All applicable legislation

3. It is not listed on:

o The National Treasury Database of Restricted Suppliers

o The Register for Tender Defaulters

4. It is tax compliant in terms of the Income Tax Act and VAT Act.

20 July 2026

5. The Bidder, identified in the offer signature block, has examined the documents listed in the Tender

Data and addenda thereto as listed in the Bid schedules, and by submitting this offer has accepted

the conditions of the Bid.

6. By the representative of the Bidder, deemed to be duly authorized, signing this part of this form of offer

and acceptance, the Bidder offers to perform all of the obligations and liabilities of the Bidder under

the Contract including compliance with all its’ terms and conditions according to their true intent and

meaning for an amount to be determined in accordance with the conditions of contract identified in the

Contract Data.

7. The Bidder hereby offers to perform the Works/Services/Goods for the full contract duration, for:

[please specify option]

Amount in Words: __________________________

Amount in Figures: _________________________

(Inclusive of VAT and all costs)

8. In the event of any discrepancy, the amount in words shall prevail. The Prices quoted above are the

total Bid offer inclusive of all applicable costs, escalation and taxes for the Contract duration. The price

must be carried over from the price breakdown / schedule of rates provided in the Bid document.

9. This offer remains valid for the period stated in the Contract Data. This offer may be accepted by

Sentech by signing the acceptance part of this form of offer and acceptance and returning one copy

of this document to the Bidder before the end of the period of validity stated in the Tender Data,

whereupon the Bidder becomes the party named as the Bidder in the conditions of contract identified

in the Contract Data.

Bidder’s Signature(s) ___________________________

Signed by the Bidder at ___________________ on this the ______ day of _________________ 20______

Full Name(s) _________________________________

Identity Number ______________________________

Capacity ___________________________________

Address (Domicilium)

Acceptance

20 July 2026

10. By executing signature below, Sentech hereby accepts the Offer subject to:

• Compliance verification
• Budget availability (PFMA section 38)
• No material misrepresentation

11. Upon signature, a binding contract comes into existence.

12. No SLA or ancillary agreement shall override this Contract unless expressly reduced to writing and

signed by both Parties.

13. The terms of the contract, are contained in:

• Part C1 Agreements and contract data, (which includes this agreement)

• Part C2 Pricing data

• Part C3 Scope of work,

and drawings and documents or parts thereof, which may be incorporated by reference into Parts

C1 to C3 above.

14. Deviations from and amendments to the documents listed in the Tender Data and any addenda thereto

as listed in the Bid schedules as well as any changes to the terms of the offer agreed by the Bidder

and the employer during this process of offer and acceptance, are contained in the schedule of

deviations attached to and forming part of this agreement. No amendments to or deviations from the

said documents are valid unless contained in this schedule of deviations.

15. Failure to fulfil any of these obligations in accordance with those terms shall constitute a repudiation

of this agreement.

16. Upon acceptance by Sentech of the Bidder's offer, a contract will come into existence between the

parties.

Sentech’s Signature(s) ________________________________

Dated and signed by Sentech at ____________ on this the __________ day of _____________ 20____

Name(s) _________________________________

Designation_______________________ ___________________________________________

SENTECH soc limited

Sender Technology Park

20 July 2026

Octave Road

Radiokop

Honeydew

Johannesburg

Schedule of deviations

1 The extent of deviations from the Bid documents issued by the Sentech before the Bid closing date is

limited to those permitted in terms of the conditions of Bid.

2 A Bidder’s covering letter shall not be included in the final contract document. Should any matter in such

letter, which constitutes a deviation as aforesaid, become the subject of agreements reached during the

process of offer and acceptance, the outcome of such agreement shall be recorded here.

3 Any other matter arises from the process of offer and acceptance either as a confirmation, clarification or

change to the Bid documents and which it is agreed by the Parties becomes an obligation of the contract

shall also be recorded here.

4 Any change or addition to the Bid documents arising from the above agreements and recorded here shall

also be incorporated into the Contract.

5 Only deviations recorded in writing and signed by both Parties shall be valid.

6 No oral representation shall be binding.

1. Subject

Details________________________________________________________

2. Subject

Details________________________________________________________

3. Subject

Details________________________________________________________

4. Subject

20 July 2026

Details________________________________________________________

7. Upon signature of this schedule of deviations by the duly authorised representatives, Sentech and the

Bidder agree to and accept the foregoing schedule of deviations as the only deviations from and

amendments to the documents listed in the Tender Data and addenda thereto as listed in the Bid schedules,

as well as any confirmation, clarification or changes to the terms of the offer agreed by the Bidder and

Sentech during this process of offer and acceptance.

8. It is expressly agreed that no other matter whether in writing, oral communication or implied during the

period between the issue of the Bid documents and the receipt by the Bidder of a completed signed copy

of this Agreement shall have any meaning or effect in the contract between the parties arising from this

Agreement.

PART 1: CONTRACT DATA – Provided by Sentech

1 The Principal / Purchaser

SENTECH soc limited

Sender Technology Park

Octave Road, Radiokop

Honeydew

Johannesburg

2 Applicable Conditions

The following shall apply:

• National Treasury General Conditions of Contract (GCC) (latest edition)
• Special Conditions of Contract (SCC)
• PFMA
• PPPFA (2022 Regulations)
• CIDB Act (if applicable)
• Companies Act
• Popia

20 July 2026

In case of any conflict:

2.1 SCC prevails over GCC;

2.2 Contract Data prevails over Scope of Work

3 Goods information

The Goods Information is in the document called “Scope of Work” and in the documents and drawings referred

to by it.

4 Terms of Delivery

The Terms of Delivery are contained in the General Conditions of Contract (GCC) and Special Conditions of

Contract.

5 Language

The language of this contract is English.

6 Governing Law & Jurisdiction

6.1 This Agreement is governed by the laws of the Republic of South Africa.

6.2 The Parties consent to the jurisdiction of the Gauteng Division of the High Court, Johannesburg, for the

institution of any and all proceedings arising from this contract.

6.3 Nothing precludes a party from seeking urgent interim relief from a competent court where

circumstances permit, and/or invoke the dispute resolution mechanisms referred to in clause 14 below.

7 Subcontracting post-award

The Bidder agrees as follows:

• It shall not subcontract, without prior written approval of Sentech, which consent may be withheld on

reasonable grounds.

20 July 2026

• Where subcontracting is permitted, the Bidder shall comply with the subcontracting requirements

prescribed under Regulation 9 of the Preferential Procurement Regulations, 2022.

• It may not subcontract more than the prescribed threshold, unless permitted by law

• It shall remain fully liable to Sentech for subcontractor performance and will indemnify Sentech for

any loss or damage caused as a result of subcontractor non-performance, theft or misappropriation.

8 BBBEE & Transformation

Where applicable:

• The Contractor shall maintain its declared BBBEE status.
• Misrepresentation constitutes material breach.
• Sentech may request a lawful transformation implementation plan aligned with BBBEE Codes.
• Failure to implement agreed milestones constitutes breach.

9 Pricing and Negotiations

• Prices are fixed in ZAR unless otherwise stated. Any foreign currency quotations shall be and remain

fixed for the full duration of the contract. Sentech is indemnified against any risk of price and/or

currency fluctuations, and such risks shall be solely borne by the Bidder.

• No escalation unless provided for in SCC. Applications for price adjustment must be accompanied by

documentary evidence in support of any adjustment and may be rejected on reasonable grounds.

• All prices inclusive of VAT.
• Documentary proof required for approved adjustments.
• Sentech reserves the right to negotiate market related prices and discounts. If market-related prices

are not agreed upon, Sentech reserves the right to terminate negotiations and invite the subsequent

ranked Bidder for negotiations or alternatively cancel the Bid.

10 Payment

10.1 All payment methods and associated conditions are incorporated in the Tender Data; GCC and SCC.

10.2 Payment shall be made within 30 (thirty) days of receipt of a valid tax invoice, subject to:

• Proper performance
• Invoice and accounting compliance
• PFMA cash flow availability

20 July 2026

11 Warranties

11.1 The Contractor irrevocably warrants:

• Proper skill and care
• Compliance with law
• No intellectual property infringement
• No bribery or corruption.

11.2 The Warranty period shall be twelve (12) months pursuant to delivery.

12 Liabilities, Indemnities & Insurance

12.1 The Contractor irrevocably indemnifies Sentech against:

• Third-party claims
• IP infringement
• Gross negligence
• Fraud
• Theft
• Misappropriation

12.2 Liability shall not exclude:

• Death or bodily injury
• Fraud
• Statutory liability

12.3 Insurance by the Contractor:

• Public liability
• Professional indemnity (if applicable)

 Proof required before commencement

13 POPIA Compliance

13.1 Both Parties shall:

• Comply with POPIA
• Implement appropriate security safeguards
• Notify each other of data breaches

20 July 2026

13.2 Personal information of the Bidder to be processed by Sentech, shall only be processed:

• For lawful procurement purposes
• On a need-to-know basis
• In accordance with lawful justification under POPIA

13.3 The Bidder has expressly consented to such processing in the spirit of this contract, for the duration

hereof and post succession.

13.4 Sentech reserves the right to conduct extensive supplier due diligence at any time pre, during or post

the contract period, including announced and unannounced site visits.

13.5 Each party shall be responsible for compliance with POPIA in respect of the personal information under

its control or processing activities.

Disputes shall be resolved as follows:

14.1 The parties shall first embark upon Negotiation within fourteen (14) days pursuant to the issuance of

a notice of breach or demand.

14.2 Subsequent to unsuccessful Negotiation, Mediation shall be attempted and administered through the

provisions of the Arbitration Foundation of Southern Africa (AFSA), Johannesburg, within fourteen

(14)days of unsuccessful Negotiations.

14.3 Should Mediation be unsuccessful, Arbitration under AFSA Rules in Johannesburg shall ensue. The

arbitration shall be governed by the Arbitration Act and AFSA Rules. The award shall be final and

binding. The unsuccessful party shall pay for the costs of the arbitration, as well as the costs of

arbitration of the successful party.

14.4 Notwithstanding the aforegoing dispute resolution mechanisms, either party shall be entitled to seek

the intervention of the High Court of South Africa, Gauteng Division, Johannesburg on an urgent

basis, for urgent interim relief.

20 July 2026

15.1 Termination for Breach

Sentech may terminate upon:

• Material breach
• Failure to remedy within 14 days
• Insolvency
• Corruption
• Misrepresentation.

15.2 Termination for Convenience

Sentech may terminate this Agreement at any time upon 30 (thirty) days written notice.

The Contractor shall be remunerated:

• For work properly performed up to termination
• Reasonable demobilisation costs (no loss of profit shall be claimable).

16 Anti-Corruption

16.1 The Contractor warrants compliance with:

• Prevention and Combating of Corrupt Activities Act (PRECCA)
• PFMA
• Treasury Regulation

16.2 It is specifically recorded that any corrupt activity constitutes material breach.

17 Evaluation and Assessments

The service delivery and performance of the Bidder shall at all relevant times be monitored and evaluated by

Sentech. In the event that the Bidder defaults in any manner or form, Sentech reserves the right to blacklist

the Bidder on the National Treasury Database of Prohibited Suppliers and Tender Defaulters in accordance

with the adoption of proper procedure, and to take such further legal steps as may be warranted in the

circumstances, which steps shall be determined at Sentech’s sole and absolute discretion.

18 Blacklisting

18.1 Any bidder / supplier / service provider restriction must comply with:

20 July 2026

• National Treasury Regulations.
• Due process.
• Audi alteram partem principle.
• Sentech shall not blacklist on National Treasury and/or Central Supplier Database (CSD) at sole

discretion without procedural fairness.

18.2 Sentech may, where appropriate and following the adoption of due process, apply for the restriction of a

supplier / service provider on the National Treasury Database of Restricted Suppliers in accordance with

applicable legislation.

19 Cession

Neither Party may cede or assign rights without written consent, except:

• Sentech may cede to another state entity subject to PFMA compliance upon prior written notice to

the Bidder.

20 Confidentiality

20.1 Both Parties must retain all proprietary and procurement information confidential.

20.2 Survives termination for 5 years.

21 Force Majeure

21.1 Neither Party shall be liable for delay caused by:

• Natural disaster
• War
• Government action
• Pandemic restrictions

subject to written notice within 5 days of the existence of such factors.

21.2 The aspect of delay damages shall be as stipulated in the Special Conditions of Contract.

22.1 This Agreement shall commence on [Date] and endure for [X] months,

subject to:

20 July 2026

• Budget availability
• Performance
• PFMA compliance

22.2 Extensions require written agreement and compliance with Treasury prescripts.

Sentech's Duly Authorized Representative is

Name: Mr. Zunaid Adams

Capacity: Executive: Legal and Regulatory.

Address: SENTECH SOC LIMITED

Sender Technology Park

Octave Road

Radiokop

Honeydew

2040

Johannesburg

Tel No. 011 471 4400

Part two - Data provided by the Bidder

Statements given in all contracts

The Bidder is:

Name

Address

a company / close corporation / partnership duly incorporated in accordance with the laws of the Republic of

South Africa.

20 July 2026

Part 2: pricing data

Must comply with:

• VAT Act
• Income Tax Act
• Treasury procurement rules

Invoices must reflect:

• Full entity names and contact details of both contracting parties
• Physical Addresses
• VAT Registration Number
• Purchase Order Number
• Contract Reference
• Description of goods/services

Part c3: scope of work

To establish a comprehensive plan, training and maintaining robust technical controls. This approach

should ensure that all stakeholders understand their roles and responsibilities when an incident

occurs.

6.1 This Agreement is governed by the laws of the Republic of South Africa.

6.2 The Parties consent to the jurisdiction of the Gauteng Division of the High Court, Johannesburg, for the

institution of any and all proceedings arising from this contract.

6.3 Nothing precludes a party from seeking urgent interim relief from a competent court where

circumstances permit, and/or invoke the dispute resolution mechanisms referred to in clause 14 below.

• It shall not subcontract, without prior written approval of Sentech, which consent may be withheld on

reasonable grounds.

20 July 2026

• Where subcontracting is permitted, the Bidder shall comply with the subcontracting requirements

prescribed under Regulation 9 of the Preferential Procurement Regulations, 2022.

• It may not subcontract more than the prescribed threshold, unless permitted by law

• It shall remain fully liable to Sentech for subcontractor performance and will indemnify Sentech for

any loss or damage caused as a result of subcontractor non-performance, theft or misappropriation.

• The Contractor shall maintain its declared BBBEE status.
• Misrepresentation constitutes material breach.
• Sentech may request a lawful transformation implementation plan aligned with BBBEE Codes.
• Failure to implement agreed milestones constitutes breach.

11.1 The Contractor irrevocably warrants:

• Proper skill and care
• Compliance with law
• No intellectual property infringement
• No bribery or corruption.

11.2 The Warranty period shall be twelve (12) months pursuant to delivery.

12.1 The Contractor irrevocably indemnifies Sentech against:

• Third-party claims
• IP infringement
• Gross negligence
• Fraud
• Theft
• Misappropriation

12.2 Liability shall not exclude:

• Death or bodily injury
• Fraud
• Statutory liability

12.3 Insurance by the Contractor:

• Public liability
• Professional indemnity (if applicable)

 Proof required before commencement

13.1 Both Parties shall:

• Comply with POPIA
• Implement appropriate security safeguards
• Notify each other of data breaches

20 July 2026

13.2 Personal information of the Bidder to be processed by Sentech, shall only be processed:

• For lawful procurement purposes
• On a need-to-know basis
• In accordance with lawful justification under POPIA

13.3 The Bidder has expressly consented to such processing in the spirit of this contract, for the duration

hereof and post succession.

13.4 Sentech reserves the right to conduct extensive supplier due diligence at any time pre, during or post

the contract period, including announced and unannounced site visits.

13.5 Each party shall be responsible for compliance with POPIA in respect of the personal information under

its control or processing activities.

14 Dispute Resolution

14.1 The parties shall first embark upon Negotiation within fourteen (14) days pursuant to the issuance of

a notice of breach or demand.

14.2 Subsequent to unsuccessful Negotiation, Mediation shall be attempted and administered through the

provisions of the Arbitration Foundation of Southern Africa (AFSA), Johannesburg, within fourteen

(14)days of unsuccessful Negotiations.

14.3 Should Mediation be unsuccessful, Arbitration under AFSA Rules in Johannesburg shall ensue. The

arbitration shall be governed by the Arbitration Act and AFSA Rules. The award shall be final and

binding. The unsuccessful party shall pay for the costs of the arbitration, as well as the costs of

arbitration of the successful party.

14.4 Notwithstanding the aforegoing dispute resolution mechanisms, either party shall be entitled to seek

the intervention of the High Court of South Africa, Gauteng Division, Johannesburg on an urgent

basis, for urgent interim relief.

15 Termination

20 July 2026

15.1 Termination for Breach

• Material breach
• Failure to remedy within 14 days
• Insolvency
• Corruption
• Misrepresentation.

15.2 Termination for Convenience

Sentech may terminate this Agreement at any time upon 30 (thirty) days written notice.

• For work properly performed up to termination
• Reasonable demobilisation costs (no loss of profit shall be claimable).

16.1 The Contractor warrants compliance with:

• Prevention and Combating of Corrupt Activities Act (PRECCA)
• PFMA
• Treasury Regulation

16.2 It is specifically recorded that any corrupt activity constitutes material breach.

20.1 Both Parties must retain all proprietary and procurement information confidential.

20.2 Survives termination for 5 years.

involved:

• Develop a cyber security incident response plan outlining the steps taken during and after an

attack, helping minimize damage, restore operations swiftly, and ensure compliance with

legal and regulatory requirements.

• Define overlap between IT incident ITIL and cyber incident process.
• Establish an incident response team with clearly assigned roles and responsibilities, ensuring

all members are trained and equipped to act swiftly during an incident.

• Detailed procedures for incident detection, analysis, containment, eradication, and recovery.
• Set up communication protocols, escalation paths, and documentation requirements for

every phase of the response process.

• Ensure compliance with relevant legal and regulatory obligations, such as data breach

notification requirements and evidence preservation for potential investigations.

• Conduct tabletop exercises and simulated attacks, to validate and refine the IR plan.
• Communication plan, notification templates, stakeholder contact list, regulatory reporting

templates, and communication logs.

and Regulatory response activities obligations register, breach

17 Evaluation and Assessments

• The tender is for the appointment of a service provider for Enterprise Cyber Incident Response Plan Development and Forensic Services.
• The contract period is 12 months.

• Complete and sign the Sentech Supplier Consent Form.
• The form must be signed by an authorised representative who warrants they are duly authorised.
• The signed form grants Sentech permission to process personal information for RFP evaluation and supplier database registration.
• Personal information may be shared with third parties for verification, background checks, and Know Your Customer (FICA) obligations.
• Withdrawal of consent may result in the RFP not being processed or removal from Sentech's supplier database.
• Ensure the consent form is submitted with the quotation response.

• Sentech Supplier Consent Form: Must be completed and signed by an authorised representative.
• The form signifies agreement to Sentech processing personal information for RFP evaluation, supplier database registration, and potential sharing with third parties for verification and FICA compliance.
• Suppliers acknowledge that withdrawal of consent may impact RFP processing and supplier registration.

• The provided document does not specify technical or financial evaluation criteria.
• A key procedural requirement is the supplier's consent to Sentech processing personal information for RFP evaluation, verification, and supplier database registration.
• Without this consent, the RFP response may not be considered.

• Scope: Appointment of a service provider for Enterprise Cyber Incident Response Plan Development and Forensic Services.
• Duration: 12 months.
• The document provided is a consent form and does not detail technical specifications; refer to the full tender document for detailed scope and deliverables.

• Suppliers must consent to Sentech processing their personal information for evaluation and registration purposes.
• Suppliers must consent to Sentech sharing personal information with third parties for verification, background checks, and FICA compliance.
• Suppliers must be willing to undergo background screening by Sentech's authorised verification agents.

Department: Supply Chain Management (SCM) at Sentech Limited. No specific contact name, email, phone, or address provided in the document.

Eligibility requirements for bidders:

• Must not be listed on the Register for Tender Defaulters or the List of Restricted Suppliers.
• Must not be a state employee, nor have directors/trustees/shareholders/partners with controlling interest employed by the state. If applicable, provide full names, ID numbers, and state employee numbers.
• Must disclose any relationships with employees of Sentech Limited or the procuring institution. Provide particulars if applicable.
• Must disclose any interest in related enterprises (whether bidding or not). Provide particulars if applicable.
• Must submit a signed declaration confirming:
• Bid was prepared independently without collusion with competitors.
• No agreements or arrangements with competitors on quality, quantity, specifications, prices, or bidding intentions.
• Bid terms have not been and will not be disclosed to competitors before official opening or award.
• No consultations or arrangements with procuring institution officials except for clarification requests.
• Bidder was not involved in drafting specifications or terms of reference.
• Bids found to be non-compliant with these declarations may be disqualified, reported to the Competition Commission or NPA, and may result in a 10-year restriction from public sector business.

Compliance requirements:

• Must complete and sign the Bidder’s Disclosure Form (SBD4).
• Must certify that all information provided in the disclosure is true and complete.
• Must accept that the state may reject the bid or take action under PFMA SCM Instruction /22 if the declaration is false.
• Must acknowledge potential penalties under the Competition Act and Prevention and Combating of Corrupt Activities Act for non-compliance or suspicious bids.

General requirements:

• Bidders must declare any state employment or controlling interest held by state employees in their enterprise.
• Bidders must disclose relationships with procuring institution employees or interests in related enterprises.
• Bidders must confirm independent bid preparation and absence of collusive practices.
• Bidders must certify that all declarations are true and complete, with penalties for false information including bid disqualification, legal action, or public sector restrictions.

The scope involves the development of an enterprise-wide cyber incident response plan and the provision of forensic services for a 12-month duration.

• RFQ Issue Date: 28 July 2026
• Compulsory Site Briefing: 03 August 2026 at 10:00 via Microsoft Teams (Link available via email: [email protected]).

28 July 2026

Microsoft Teams 10:00

Compulsory Site Briefing 03 August 2026

[email protected] for the link

• Administrator: Nomaswazi Mhlanga
• Telephone: 011 246 2600
• Email: [email protected]

• Submission Method: Quotations must be submitted via email to [email protected].
• Format: All quotations must be on a company letterhead and fully completed/signed in BLACK ink.
• Deadline: Must be received on or before the closing date and time specified.
• Validity: 90 days.
• Confidentiality: All terms and Purchaser's information must be treated as confidential.

the RFQ and addenda thereto as listed in the Returnable Schedules, and by submitting this Offer has accepted the Conditions of this RFQ.

Bidders must: (1) Be registered on the Sentech Supplier Database; (2) Be tax compliant; (3) Hold a valid ISO/IEC 27001 certification; (4) Hold a valid CREST or GIAC digital forensics accreditation/certification; (5) Submit quotations on company letterhead, fully completed and signed in black ink; (6) Submit via email before the closing date/time; (7) Provide a dedicated project team with at least three years' experience and relevant certifications; (8) Demonstrate capability to deliver implementation within three months or less; (9) Provide contactable references for similar cyber security/IR implementations in the last five years; (10) Submit a valid B-BBEE Certificate to claim preference points. Bidders that do not comply with all mandatory eligibility criteria will not be evaluated further.

The service provider is required to deliver:

• Enterprise Cyber Incident Response Plan development.
• Forensic services for a period of 12 months.
• Implementation of incident detection, logging, and reporting processes.
• Development of scenario-based playbooks, containment, and recovery procedures.
• Forensic procedures including evidence registers and chain-of-custody forms.
• Integration of legal and regulatory requirements (POPIA, Cybercrimes Act).

Bidders must provide a detailed implementation plan including:

• Methodology and life cycle phases.
• A realistic schedule/timeline (not exceeding three months).
• Gantt charts and milestones.
• Clear deliverables aligned with the scope of work.

• Technical Team: Must have a dedicated project team with at least 3 years of experience.
• Required Certifications: PMBOK, CISSP, CISM, CompTIA Security+, CySA+, CISA, or GIAC.
• Track Record: Must provide contactable references for cyber security/IR implementations completed within the last 5 years.

(in words) .................................................................................................................................................

............................................................................Rand

;

R.........................................................(in figures)

• All prices must be quoted in South African Rand (ZAR).
• Prices must be inclusive of VAT.
• No price adjustments will be made without written approval and documentary evidence.
• Bidders bear the risk of currency fluctuations.

• Must be registered on the Sentech Supplier Database.
• Must be tax compliant.
• Must provide a valid B-BBEE Certificate to claim preference points.
• Mandatory certifications: ISO/IEC 27001 and Digital Forensics (CREST or GIAC).

Historically disadvantaged by unfair discrimination on 10 A valid BBBEE Certificate

the basis of Race showing at least 51% black

ownership

5 A valid BBBEE Certificate

showing at least 25.1 – 50%

black ownership

3 Black owned company

showing at least 5 – 25%

black ownership

0 Below 5%

Historically disadvantaged by unfair discrimination on 8 A valid BBBEE Certificate

the basis of Gender (women) showing at least 51% women

ownership

4 A valid BBBEE Certificate

showing at least 25.1 – 50%

women ownership

2 A valid BBBEE Certificate

showing at least 5-25%

women ownership

0 A valid BBBEE Certificate

showing at less than 5%

women ownership

Historically disadvantaged by unfair discrimination on 2 A doctor’s note confirming

the basis of disability disability

Total Points 20

• Upon award, the service provider must arrange delivery of securities, bonds, guarantees, and proof of insurance within two days of receiving the signed agreement.
• Failure to provide required documentation constitutes a repudiation of the agreement.

2. AWARD OF RFQ’s

Sentech may appoint one or more suppliers, in whole or in part, or not appoint any supplier/s at all, and/or cancel the bid in its entirety, at Sentech’s sole and exclusive discretion, in order to satisfy various needs which may be identified, and to manage certain risks associated with the supply of goods or services specified in respect of the Bid.

1.1. Suppliers are required to ensure that they meet all the Administrative Responsiveness Criteria.

Quote. It is the service provider’s responsibility to ensure that they are tax compliant and that all required information is submitted to Sentech. Supplier’s providing quotations must be registered on the Sentech Supplier Database.

1.2. Quotations must be in a Company Letterhead.

1.3. Quotations or Proposals must be received on or before the closing date and time specified on the Call for Quotation or Proposal document.

1.4. Quotations or Proposals must be fully completed and signed in BLACK ink.

1.5. Quotations must be submitted via Email.

1.6. The Tenderer undertakes to the Purchaser that it will treat as confidential the terms of this RFQ together with all the Purchaser's confidential information and will not disclose such confidential information to any person, firm or company (other than to its auditors and other professional advisers) or to the media, and will not use such confidential information other than for the purposes of this RFQ, subject always to any prior specific authorisation in writing by the Purchaser to such disclosure or use.

Evaluation is conducted in three stages: 1. Administrative Responsiveness, 2. Mandatory and Functional (Min score 16/25), and 3. Price and Preference (80/20). Mandatory requirements include ISO/IEC 27001 and Digital Forensics (CREST/GIAC) certification.